[Bug 1462311] Re: proftpd mod_copy issue (CVE-2015-3306)

[Tyler Hicks]

Thanks for taking the time to report this bug and helping to make Ubuntu
better. Since the package referred to in this bug is in universe or
multiverse, it is community maintained. If you are able, I suggest
coordinating with upstream and posting a debdiff for this issue. When a
debdiff is available, members of the security team will review it and
publish the package. See the following link for more information:
https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

** Changed in: proftpd-dfsg (Ubuntu)
       Status: New => Incomplete

** Information type changed from Private Security to Public Security

-- 
You received this bug notification because you are a member of ProFTPD
Maintainance Team, which is subscribed to proftpd-dfsg in Ubuntu.
https://bugs.launchpad.net/bugs/1462311

Title:
  proftpd mod_copy issue (CVE-2015-3306)

Status in proftpd-dfsg package in Ubuntu:
  Incomplete

Bug description:
  The CVE-2015-3306 problem is arround for some time now and is not fixed in 12.04 and 14.04 LTS versions.
  http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3306.html

  I also tested it with telnet.
  I can copy files without any authentication if mod_copy is enabled (mod_copy is per default enabled!)
  The module is very usefull. I would be happy if I can re enable it on my servers.

  
  Debian and other distributions have already fix this in their systems.
  http://bugs.proftpd.org/show_bug.cgi?id=4169
  https://security-tracker.debian.org/tracker/CVE-2015-3306

  Is there a special reason why this still not fixed on the LTS versions
  of Ubuntu?

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/proftpd-dfsg/+bug/1462311/+subscriptions